CVE-2026-73126: Gitea private workflow badge token scope bypass
Gitea's Actions workflow status badge endpoint does not enforce repository-read scope or the public-only restriction on the token authenticating the request. A token lacking read:repository, or restricted to public repositories, can retrieve the latest workflow status of a private repository accessible to its owner. This discloses private workflow status beyond the token's intended delegated permissions.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Private repositories are exposed when their owner has a token that can authenticate to the workflow badge endpoint but lacks repository-read permission or is restricted to public repositories. The issue can disclose the latest workflow status for private repositories accessible to that token's owner.
What access does an attacker need to retrieve private workflow status?
The attacker needs a token that authenticates to the badge endpoint and belongs to, or is otherwise associated with, an owner who can access the private repository. The token does not need repository-read scope, and a token restricted to public repositories can still be affected.
What information can be disclosed?
The endpoint can reveal the latest Actions workflow status of a private repository. The provided information does not indicate disclosure of repository contents, workflow definitions, or logs.